Information about test disclosed to a non-management employee, leading to workplace rumours
A recent case serves as a reminder that claims under the Privacy Act 2020 could have significant consequences for employers – in this case to the tune of $30,000.
In Cummings v. KAM Transport Limited [2025] NZHRRT 8, the Human Rights Review Tribunal determined that an employer breached an employee’s privacy, causing the employee humiliation and a loss of dignity.
In this case, Mr Cummings was employed by KAM Transport Limited as a truck driver. He was required by KAM to undertake a random drug test in accordance with the terms and conditions of his employment. Cummings refused to undertake the test which, under KAM policy and the terms of his employment, was grounds for misconduct. He was stood down pending a disciplinary process.
Cummings subsequently undertook a drug test on 4 September 2020, which returned clear. Cummings returned to work after that, although the disciplinary process remained in place.
It soon became apparent to Cummings that false rumours regarding the drug test and its outcome had spread amongst his colleagues. Cummings was confronted by a forklift driver who told him that she and others had heard that he was a drug dealer and had been dismissed from his job. He was told by another colleague that they had heard from another KAM employee that Cummings had failed a drug test and had left his employment. Cummings was taken by surprise and denied that this was the case. He felt anxious and was distressed by the implications of the rumour for his safety and reputation.
Cummings raised concerns with KAM, which investigated the matter and found that no privacy breach had occurred. KAM also issued Cummings a warning for refusing to undergo the random drug test. The parties met but no resolution was reached.
On 14 December 2020, Cummings wrote to KAM to advise that he was resigning from his employment with immediate effect, citing – among other things – a loss of trust. The parties then attended mediation, but no resolution was reached.
Cummings subsequently lodged a complaint with the Privacy Commissioner regarding his allegation that KAM had interfered with his privacy. Following the conclusion of the Privacy Commissioner’s investigation in May 2022, Cummings filed his claim in the tribunal.
Cummings claimed that KAM had interfered with his privacy by disclosing his personal information without authorisation regarding his refusal to undertake a drug test – in breach of Information Privacy Principle (IPP) 11 of the Privacy Act 1993 (PA, which was repealed and replaced by the Privacy Act 2020 on 1 December 2020. Given the timing of the alleged disclosure and interference with privacy, the determination was made under the PA. There is no substantive difference between the provisions engaged under the 1993 Act and the 2020 Act). Consequently, Cummings claimed that he had suffered detriment and loss and that his rights and privileges were adversely affected causing him significant humiliation, loss of dignity and injury to his feelings.
The tribunal considered:
Whether there had been a disclosure - Yes, the employer disclosed information to the employee who had told others about the drug test failure and who was not part of the KAM management group, and had no need to know such sensitive information about Cummings.
Whether this disclosure could have been lawfully made under one of the exceptions provided by IPP 11 - No, KAM also did not plead that any of the exceptions applied and did not rely on them (depending instead on the argument that no disclosure had been made, which was not accepted).
(If not) whether the disclosure constituted an interference with privacy by causing actual or potential harm - Yes, the matters disclosed involved personal information of a highly personal and sensitive nature. The harm Cummings suffered amounted to significant humiliation, loss of dignity and injury to his feelings, particularly given his long career and status as a senior truck driver. There was a sufficient casual connection between the harm suffered and the disclosure.
(If so) whether it should grant any statutory remedies - Yes, the tribunal considered that a declaration (that KAM interfered with Cummings’ privacy without his consent), and damages of $30,000 for humiliation, loss of dignity and injury to feelings were appropriate remedies. However, his loss of earnings claim of $295,366.50 and loss of benefit damages were not awarded, due to a lack of causal connection between the breach and the harm suffered.
Elisabeth Giles is a Senior Solicitor in the Employment Law Team at Lane Neave in Christchurch. Sarah Wadworth is a Special Counsel in the Employment Law and Family teams at Lane Neave in Wellington. Fiona McMillan is a Partner in the Employment Law Team at Lane Neave in Auckland. Andrew Shaw is head of the Employment Law Team at Lane Neave in Christchurch. Andy Bell is a Partner specialising in dispute resolution and litigation at Lane Neave in Wellington.
